Re: [PATCH bpf v3 2/2] selftests/bpf: Check per-CPU address resolution per register

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] The test uses an unrecognized section name `SEC(".percpu")` for its global variable, preventing libbpf from loading the test.
- [High] The test's inline assembly is missing the `mov_percpu_addr` instruction, causing the `__jited` assertions to always fail.
--

--- Patch [2]: [PATCH bpf v3 2/2] selftests/bpf: Check per-CPU address resolution per register ---
commit 94ba39b00c54962b463da6e18c62f89978f29a3f
Author: Vineet Gupta <[email protected]>

selftests/bpf: Check per-CPU address resolution per register

This commit adds a BPF selftest to verify that the x86 JIT correctly encodes
the per-CPU address resolution. It loads a .percpu variable into all registers
and matches the JITed add instruction against the expected register.

> diff --git a/tools/testing/selftests/bpf/progs/verifier_percpu_addr.c b/tools/testing/selftests/bpf/progs/verifier_percpu_addr.c
> new file mode 100644
> index 0000000000000..967f4e6e3a490
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/verifier_percpu_addr.c
> @@ -0,0 +1,72 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +#include <vmlinux.h>
> +#include <bpf/bpf_helpers.h>
> +#include "bpf_misc.h"
> +
> +#if defined(__TARGET_ARCH_x86)
> +
> +int percpu_data SEC(".percpu");

[Severity: High]
Does libbpf support the SEC(".percpu") section name?

When bpf_object__elf_collect runs, it skips the .percpu section as it doesn't
match known data section prefixes like .data. Later, when
bpf_object__relocate_data processes the R_BPF_64_64 relocation for the
percpu_data load, bpf_object__section_to_libbpf_map_type returns
LIBBPF_MAP_UNSPEC.

Since the section is not the BTF maps section, this results in a bad map relo
warning and returns -LIBBPF_ERRNO__RELOC, causing the test to fail to load.

[ ... ]

> +__naked void percpu_addr(void)
> +{
> +	asm volatile ("					\
> +	r0 = %[percpu_data] ll;				\
> +	r1 = %[percpu_data] ll;				\

[Severity: High]
Are the mov_percpu_addr instructions missing from this inline assembly?

The commit message notes that an ld_imm64 of a per-CPU map value is followed
by a mov_percpu_addr, but the assembly here only emits a BPF_LD_IMM64
instruction.

The verifier processes this as BPF_PSEUDO_MAP_VALUE and converts it to a
standard 64-bit immediate load. Without the BPF_MOV64_PERCPU_REG
(mov_percpu_addr) instruction, the x86 JIT emits movabsq but never emits the
addq %gs:..., %reg instruction. This causes the __jited assertions to fail.

> +	r2 = %[percpu_data] ll;				\
> +	r3 = %[percpu_data] ll;				\
> +	r4 = %[percpu_data] ll;				\

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2